Last updated: 6 May 2026
Pacific Board S.L., trading as Pulso ("we", "us", or "our"), is committed to protecting your personal data and respecting your privacy. We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "GDPR") and any other applicable data protection legislation.
This Privacy Policy explains:
This policy applies to:
If you are an authorized user of Pulso — meaning an employee or collaborator of one of our Customers whose Pulso user account was created by that Customer — we process a limited set of your personal data (account, authentication, and activity data) as a data controller, in order to operate, secure, and support the platform on behalf of the Customer that granted you access. Section 4.10 describes this processing.
If you are an end user of Pulso — meaning a client of one of our Customers who has had a booking processed through the platform — we process your personal data on behalf of that Customer. In that context we act as a data processor, not a controller; please contact the relevant Customer directly for any questions about your data. Section 6 of this policy describes this processor role.
The data controller responsible for the processing described in this policy is:
Pacific Board S.L.
Trading as: Pulso
CIF: B16674541
Registered at the Registro Mercantil de Barcelona, Tomo 47929, Folio 16, Hoja 566629, Inscripción 1
Carrer del Doctor Fleming 55, 2-2
Castelldefels, 08860 Barcelona, Spain
Privacy contact: [email protected]
Website: https://pulsorent.com
We have not designated a Data Protection Officer, as the processing activities described in this Privacy Policy do not fall within the mandatory designation criteria of Article 37(1) GDPR. You may address any data-protection enquiry to the privacy contact above.
Pulso operates in two distinct roles under the GDPR, depending on whose data is being processed.
3.1 Data Controller
We act as data controller — determining the purposes and means of processing — for the personal data we collect from:
This Privacy Policy governs how we handle that data.
3.2 Data Processor
We act as a data processor — exclusively on our Customers' documented instructions and for no purpose of our own — for end-user booking data: personal data that our Customers store in the Pulso platform about their own clients (for example, when recording a rental booking).
For end-user booking data, the relevant Customer is the data controller and is responsible for providing appropriate privacy information to the data subject, for establishing a lawful basis, and for responding to data subject rights requests. Pulso's processing of this data is governed by the Data Processing Agreement (DPA) between Pulso and each Customer, which forms part of our Terms and Conditions and satisfies the requirements of Article 28 GDPR.
If you are an end user, please contact the relevant Customer directly for any matter concerning your personal data.
The following sections describe each context in which we collect personal data as a controller, the categories of data involved, and the legal basis we rely on under Article 6 GDPR.
To use Pulso, a Customer must first create an account. We offer a 14-day free trial, for which an account needs to be registered with the following data:
Data collected:
Legal basis: Performance of a contract or pre-contractual steps at your request (Article 6(1)(b) GDPR).
Prospective customers may book a demonstration of Pulso via our website. Demo bookings are collected and managed through our scheduling partner Cal.com, Inc., which acts as our data processor under a signed Data Processing Agreement. The data you provide passes through Cal.com and is made available to us for the purpose of contacting you and delivering the demo.
Data collected:
Legal basis: Pre-contractual measures taken at your request (Article 6(1)(b) GDPR).
Visitors and users may contact us through the contact form on our website at any time. The contact form is hosted by Tally BV, which acts as our data processor under a signed Data Processing Agreement. Submitted data passes through Tally's EU-based infrastructure and is delivered to us to process your enquiry.
Data collected:
Legal basis: Your consent (Article 6(1)(a) GDPR), given by voluntarily submitting the form. You may withdraw your consent at any time by emailing [email protected]; withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
When a Customer subscribes to a paid plan, we collect billing details for invoicing purposes.
For invoicing a company:
For invoicing an individual:
We do not store payment card details ourselves. Card payments are processed by Stripe, Inc. and bank direct debit orders are processed by GoCardless Ltd. Invoices are issued and managed through Zoho Billing, offered in the European Union by Zoho Corporation B.V., with which we have contracted directly. Each of these providers processes data in accordance with their own data protection obligations and our instructions.
Legal basis: Performance of a contract (Article 6(1)(b) GDPR) and compliance with legal obligations under applicable Spanish tax and commercial law (Article 6(1)(c) GDPR).
Throughout an active subscription, we process data necessary to deliver, maintain, secure, and support the Pulso service.
Data processed:
Legal basis: Performance of a contract (Article 6(1)(b) GDPR) and our legitimate interest in ensuring the security, stability, and ongoing improvement of the platform (Article 6(1)(f) GDPR).
With your explicit consent, we send marketing emails about Pulso's features, updates, and promotions.
Data collected:
You may withdraw your consent and unsubscribe at any time by clicking the unsubscribe link in any marketing email, or by contacting us at [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Legal basis: Consent (Article 6(1)(a) GDPR).
Marketing to existing customers. Where you are already a Customer of Pulso, we may send you commercial communications about our own similar products and services on the basis of our legitimate interest and in accordance with Article 21(2) of Spain's Law 34/2002 on Information Society Services (LSSI), which permits such communications without prior consent provided you have an easy, free, and always-available means to opt out. Every such email will include a clear unsubscribe link, and you may also opt out at any time by emailing [email protected].
We use analytics, session-recording, and advertising technologies on our website to understand how visitors interact with it, identify issues, improve the user experience, measure the effectiveness of our advertising, and deliver relevant ads.
Analytics (Google Analytics). We use Google Analytics to generate aggregate statistics about website usage. The data collected includes:
Session recording (Microsoft Clarity). Microsoft Clarity is a session-replay tool that records a visual reconstruction of your interaction with our website — including mouse movements, scrolling, clicks, and form interactions. Sensitive fields (including but not limited to passwords, payment details, and identification numbers such as DNI or passport) are masked before recording so that their contents are never captured or transmitted. Clarity helps us identify usability problems, frustration signals (e.g., dead clicks, rage clicks), and errors.
Google Ads conversion tracking. We run advertising campaigns on Google Ads and use Google Analytics, linked to our Google Ads account, to measure ad conversions and campaign effectiveness. This allows us to understand which advertising channels bring visitors who subsequently sign up for a trial, book a demo, or subscribe. Data shared with Google in this context includes conversion events, referral source, and anonymised device and browser information.
Meta Pixel. We use the Meta (Facebook) Pixel on our website to measure the effectiveness of our advertising campaigns on Facebook and Instagram, to build audiences for retargeting, and to optimise future campaigns. The Meta Pixel sends Meta Platforms Ireland Limited and its affiliates (together, "Meta") information about your visit, including pages viewed, actions taken, and a hashed identifier. Meta may combine this information with data it holds about you for its own purposes, as described in its Data Policy.
Joint controllership with Meta. In respect of the collection and transmission of personal data via the Meta Pixel, we and Meta act as joint controllers within the meaning of Article 26 GDPR. Meta and we have entered into Meta's Controller Addendum (the "Joint Controller Arrangement"), which allocates responsibilities as follows: (i) we are responsible for providing the information required by Articles 13 and 14 GDPR to visitors and for obtaining a valid consent before the Pixel fires; (ii) Meta is responsible for complying with data subject rights (Articles 15 to 22 GDPR) in respect of the joint processing and for implementing appropriate security measures. The essence of this arrangement is summarised above; data subjects may exercise their GDPR rights against either party, but rights in respect of the joint processing are best addressed to Meta through the Meta Privacy Center. Any subsequent processing of the data by Meta for its own purposes falls outside the joint controllership and is governed by Meta's own privacy policy.
Legal basis: Your consent (Article 6(1)(a) GDPR), granted through our cookie consent banner. You may withdraw your consent at any time by adjusting your cookie preferences via https://pulsorent.com/en/cookies-management/. Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal.
We collect personal data directly from you when you interact with our website, create an account, book a demo, submit the contact form, subscribe to a paid plan, or use the Pulso platform. Certain technical data (IP address, device, and session information) is collected automatically when you access our website or services.
We do not purchase lead lists, enrich personal data from third-party databases, or obtain information about you from social networks or other external sources for our own purposes.
Providing certain personal data is necessary for us to enter into and perform a contract with you:
When one of our Customers invites an employee, collaborator, or other individual to access the Pulso platform as an authorized user — by creating a Pulso user account for them — we act as data controller in respect of the account, authentication, and activity data necessary to operate the platform for that user.
Data collected:
Purposes: creating and administering the user account; authenticating the user; operating, securing, and supporting the platform; maintaining the traceability and integrity of actions taken within the platform; and complying with our legal obligations.
Legal basis: Our legitimate interest (Article 6(1)(f) GDPR) in providing, securing, and supporting the Pulso platform for the Customer that granted the authorized user access, and in ensuring the accountability and integrity of actions taken within the platform. Where applicable, we also rely on the performance of our contract with the relevant Customer (Article 6(1)(b) GDPR) and compliance with legal obligations to which we are subject (Article 6(1)(c) GDPR).
If you are an authorized user and no longer wish to have a Pulso account, please contact the Customer who granted you access; the Customer can revoke or delete your access at any time through the platform. You may also contact us at [email protected] to exercise any of the rights described in Section 9.
Pulso is a business-to-business service designed for companies operating in the equipment rental industry. It is not intended for, nor directed at, children. We do not knowingly collect personal data from minors under the age of 14 (the digital consent age under Article 7 of Spain's Organic Law 3/2018, LOPDGDD) when acting as a data controller.
Our Customers may, in the course of their own booking activities, enter personal data relating to end users who are minors. In such cases, the Customer is the data controller and is responsible for:
Pulso processes such data only on the Customer's documented instructions, in accordance with the Data Processing Agreement.
If you believe that a minor has provided personal data directly to Pulso (and not via a Customer), please contact us at [email protected] and we will delete the data without undue delay.
We do not retain personal data for longer than is necessary for the purposes for which it was collected, or for longer than required by law. Further, we explain what the retention period is for each data category.
| Data Category | Retention Period |
|---|---|
| Account and platform usage data | Duration of the active subscription |
| Authorized-user accounts (account, authentication, and activity data of users invited by a Customer) | Duration of the Customer's active subscription; deleted on the same 30-day grace-period schedule as the Customer's account |
| Data following account cancellation or deletion | 30-day grace period for data export, then permanently deleted |
| Billing records, invoices, and associated identifiers (DNI, passport number, CIF, VAT) | 6 years from the date of issue, as required by the Spanish Commercial Code (Código de Comercio, Article 30) and tax law |
| Demo requests, non-converting leads, and free-trial accounts that are not converted to a paid subscription | 2 years from the date of last interaction |
| Contact form submissions | Until the enquiry is resolved, and in any event no longer than 2 years from the last interaction |
| Newsletter and marketing email data | Until unsubscribe; a suppression record (email address only) is retained to prevent accidental re-subscription |
| Technical logs, IP addresses, and analytics data | Up to 12 months from the date of collection |
After the applicable retention period, data is permanently deleted or anonymised so that it can no longer be associated with an identifiable individual.
Backups. Following deletion from our active systems, personal data may persist in encrypted backups for up to 7 days before being automatically overwritten. During this period, backups are stored solely for disaster-recovery purposes and are not accessed for any operational use. If data must be restored from a backup, any data that had previously been subject to a deletion request will be re-deleted immediately after restoration.
Data exports. Where you or a Customer requests an export of personal data (for example, prior to account cancellation or in exercise of the right to data portability), exports are provided in a structured, commonly used, machine-readable format — typically CSV.
We recommend that Customers export any data they require before cancelling their account, as we cannot recover data after the 30-day grace period has elapsed.
When our Customers use the Pulso platform to manage their equipment rental operations, they record personal data about their own clients in the platform ("End-User Booking Data"). End-User Booking Data is stored on Pulso's infrastructure and processed exclusively on behalf of, and under the documented instructions of, the relevant Customer.
Categories of End-User Booking Data that Customers may store in Pulso include:
Pulso does not use End-User Booking Data for its own purposes, does not claim any ownership over it, and will not contact, profile, or market to Customers' clients, nor use End-User Booking Data to compete with Customers. Authorised Pulso employees may access End-User Booking Data only where strictly necessary to provide technical support to the relevant Customer. All Pulso personnel with access to End-User Booking Data are bound by written confidentiality obligations, in accordance with Article 28(3)(b) GDPR.
Our Customers are the data controllers of End-User Booking Data and are responsible for:
The processing of End-User Booking Data by Pulso on behalf of Customers is governed by the Data Processing Agreement (DPA) that forms part of our Terms and Conditions.
If you are an end user and wish to exercise any of your GDPR rights (access, deletion, etc.), please contact the relevant Customer directly. We are unable to act on your rights request independently unless we receive a formal instruction to do so from the relevant Customer. Where we receive a rights request directly from an end user, we will forward it to the relevant Customer without undue delay (and in any event within three working days) and inform the end user that we have done so.
We engage third-party service providers who process personal data on our behalf as sub-processors. All sub-processors are required to implement appropriate technical and organisational security measures and to process data only in accordance with our documented instructions.
Where sub-processors are located outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place for the transfer, primarily through the European Commission's Standard Contractual Clauses (SCCs) or, where applicable, the EU–US Data Privacy Framework (DPF).
We do not sell your personal data to any third party.
| Provider | Purpose | Data Location | Transfer Safeguard |
|---|---|---|---|
| DigitalOcean, LLC | Cloud hosting and infrastructure | Frankfurt, Germany (EU) | EU servers + SCCs with US parent entity |
| Stripe, Inc. | Credit card payment processing | United States | SCCs / EU–US DPF |
| GoCardless Ltd | Bank direct debit processing | United Kingdom | UK Adequacy Decision |
| Zoho Corporation B.V. | Invoice issuance and billing management | EU servers | Within EEA — no transfer |
| Google LLC (Google Analytics) | Website analytics | United States | SCCs / EU–US DPF |
| Microsoft Corporation (Microsoft Clarity) | Session recording and UX analytics | United States | SCCs / EU–US DPF |
| Meta Platforms, Inc. (Meta Pixel) | Advertising measurement and retargeting | United States | SCCs / EU–US DPF |
| HubSpot, Inc. | CRM and lead management (back-office; no website tracking script) | United States | SCCs / EU–US DPF |
| Woodpecker.co sp. z o.o. | Newsletter and marketing email delivery | Poland (EU) | Within EEA — no transfer |
| Twilio Inc. (SendGrid) | Transactional email delivery (account verification, password resets, service notifications) | United States | SCCs / EU–US DPF |
| Cal.com, Inc. | Demo scheduling | United States | SCCs |
| Tally BV | Contact form processing | Belgium (EU) | Within EEA — no transfer |
| BetterStack | Application log management and monitoring | EU | Within EEA — no transfer |
A copy of the Standard Contractual Clauses or other applicable transfer safeguards is available upon request at [email protected].
We may engage new sub-processors or replace existing ones from time to time. Where this materially affects the processing of your personal data, we will update the list above and, for Customers, follow the notification and objection procedure set out in the Data Processing Agreement.
If Pulso is involved in a merger, acquisition, restructuring, sale of assets, bankruptcy, or similar corporate event, personal data processed under this Privacy Policy may be transferred to the acquiring or successor entity. In such cases, we will ensure that the receiving entity is bound by data protection obligations at least equivalent to those set out in this Privacy Policy. Where required by applicable law, we will notify affected data subjects of any material changes and of their options.
We take the security of personal data seriously and have implemented appropriate technical and organisational measures to protect it against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.
Our security measures include, but are not limited to:
No method of transmission over the internet or electronic storage is completely secure. While we strive to use commercially acceptable means to protect personal data, we cannot guarantee absolute security.
In the event of a personal data breach, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify affected individuals without undue delay, in accordance with Article 34 GDPR.
Where we process your personal data as a data controller, you have the following rights under the GDPR. To exercise any of them, please contact us at [email protected].
| Right | What it means |
|---|---|
| Right of access | You may request a copy of the personal data we hold about you and information about how we process it. |
| Right to rectification | You may ask us to correct inaccurate data or complete incomplete data we hold about you. |
| Right to erasure ("right to be forgotten") | You may ask us to delete your personal data where we no longer have a lawful basis to retain it. |
| Right to restriction of processing | You may ask us to suspend processing of your data in certain circumstances (e.g., while you contest its accuracy). |
| Right to data portability | Where processing is based on your consent or a contract, you may request your data in a structured, commonly used, machine-readable format for transfer to another controller. |
| Right to object (legitimate interest) | You may object at any time to processing based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or for the establishment, exercise, or defence of legal claims. |
| Right to object (direct marketing) | You may object at any time to the processing of your personal data for direct marketing purposes. This right is absolute: upon your objection, we will stop processing your data for marketing purposes immediately, with no balancing test applied (Article 21(3) GDPR). |
| Right to withdraw consent | Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing. |
| Right not to be subject to automated decisions | You have the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal or similarly significant effects on you. Pulso does not make such automated decisions. |
We will respond to your request within one calendar month. For complex or multiple requests, this period may be extended by a further two months, in which case we will notify you within the first month. We may ask you to verify your identity before acting on your request, and where we do so we will request only the minimum information necessary to confirm your identity.
How to withdraw specific consents. Where processing is based on your consent, you can withdraw that consent at any time through the following channels:
Manifestly unfounded or excessive requests. Where a request is manifestly unfounded or excessive — in particular because of its repetitive character — we may, in accordance with Article 12(5) GDPR, either charge a reasonable fee to cover administrative costs or refuse to act on the request. In either case, we will explain our reasoning in writing.
Your responsibility for the accuracy of the data you provide. You are responsible for ensuring that the personal data you provide to us is accurate, complete, and up to date. You can review and update your account details at any time through the Pulso platform or by contacting us at [email protected].
Note for authorized users: If you are an authorized user of Pulso (an employee or collaborator of one of our Customers), you may exercise the rights above directly with us in respect of your platform-account data (as described in Section 4.10). For any data that your employer has recorded about you inside the platform as part of its own operational records, please direct your request to that Customer, as they are the data controller for that data.
Note for end users: If you are a client of one of our Customers whose booking data has been recorded in the platform, please direct any rights requests to that Customer directly. We are not able to process your request independently unless instructed by the relevant Customer.
You have the right to lodge a complaint with a data protection supervisory authority if you believe your personal data has been processed unlawfully or that your rights have not been respected.
The lead supervisory authority for Pulso is:
Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6
28001 Madrid, Spain
Tel: +34 912 663 517
Website: https://www.aepd.es
You may also lodge a complaint with the supervisory authority of your country of habitual residence or place of work within the EU or EEA.
We would, however, appreciate the opportunity to address your concerns before you contact the AEPD. Please reach out to us at [email protected] first.
We use cookies and similar technologies on our website for functional, analytical, and marketing purposes. For detailed information about the cookies we use, their purposes, and how to manage your preferences, please refer to our Cookie Policy, available at https://pulsorent.com/en/cookies-management/.
Pulso does not make decisions based solely on automated processing — including profiling — that produce legal effects or similarly significant effects on individuals. All significant decisions involving personal data involve human review.
We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, or applicable legal requirements. The date of the most recent revision is shown at the top of this document.
Where changes are material, we will notify affected data subjects for whom we hold a current email address — including active Customers, newsletter subscribers, and other individuals who have interacted with us — by email and/or through a notice within the Pulso platform at least 30 days before the changes take effect. Where we do not hold a current email address, the updated policy will be published on our website. For non-material changes, the updated policy will be published on our website.
We encourage you to review this policy periodically.
For any questions or concerns about this Privacy Policy or to exercise your data protection rights, please reach us at:
Pacific Board S.L. (Pulso)
CIF: B16674541 · Registro Mercantil de Barcelona, Tomo 47929, Folio 16, Hoja 566629, Inscripción 1
Carrer del Doctor Fleming 55, 2-2
Castelldefels, 08860 Barcelona, Spain
Privacy contact: [email protected]
Website: https://pulsorent.com